Event messages produced by the devices in a computer system, such as a computer center or server system, are used to monitor and manage computer systems and networks. In addition to reporting the health of network devices, hosts and servers, event messages also report on activities, such as network traffic, observed by the devices in a computer system. The counts of various event messages can be correlated to detect system conditions and/or predict problems.
Typically, the counting of event messages produced by the devices in a computer system is done at a single node. However, a single node may not have adequate memory capacity to store counts of event attributes that have large ranges. For example, Internet Protocol version 4 has over 4 billion unique addresses and Internet Protocol version 6 has 2128 unique addresses. In addition, a single node may not have the processing capacity to count and analyze events that are received at a high rate. Also, event messages that are generated at geographically disparate locations may make it infeasible to aggregate event processing at a single node due to bandwidth and storage limitations.